[dependabot]

Bumps the npm-minor-patch group with 37 updates in the / directory:

Package	From	To
@ai-sdk/gateway	4.0.90	4.0.121
@google-cloud/text-to-speech	7.1.0	7.2.0
@google/genai	2.24.0	2.30.0
@types/node	26.0.0	26.6.5
ai	7.0.112	7.0.148
chrome-devtools-mcp	1.10.1	1.11.0
dotenv	18.0.3	18.0.8
openai	7.23.0	7.41.0
@modelcontextprotocol/sdk	1.30.1	1.32.1
turbo	2.11.3	2.11.10
undici	8.11.0	8.12.3
@ai-sdk/react	4.0.117	4.0.152
@flags-sdk/vercel	1.4.9	1.5.2
@opentelemetry/api	1.9.1	1.10.0
@opentelemetry/exporter-trace-otlp-http	0.222.0	0.300.0
@opentelemetry/instrumentation	0.222.0	0.300.0
@opentelemetry/sdk-trace-base	2.11.0	2.12.0
@radix-ui/react-label	2.1.15	2.1.17
@radix-ui/react-separator	1.1.15	1.2.0
@radix-ui/react-tabs	1.1.21	1.2.1
@sentry/nextjs	11.0.0	11.8.0
@supabase/supabase-js	2.117.1	2.118.0
@v0-sdk/react	3.0.7	3.0.12
@vercel/blob	2.8.0	2.8.2
@vercel/functions	3.9.9	3.10.2
lucide-react	1.47.0	1.61.0
react-resizable-panels	4.13.2	4.14.8
redis	6.2.1	6.3.0
tldts	7.4.15	7.4.19
v0	3.0.7	3.0.12
zod	4.6.5	4.6.7
@playwright/test	1.63.0	1.64.1
eslint-config-next	16.3.6	16.4.2
jsdom	30.1.1	30.1.3
playwright	1.63.0	1.64.1
postcss	8.5.28	8.5.31
vite	8.3.0	8.3.5

Updates @ai-sdk/gateway from 4.0.90 to 4.0.121

Changelog

Sourced from @​ai-sdk/gateway's changelog.

4.0.121

Patch Changes

• f1b550e: Defer construction of provider validation schemas until first use to reduce package import time.
• Updated dependencies [b089ce8]
• Updated dependencies [39a776b]
  • @​ai-sdk/provider-utils@​5.0.65

4.0.120

Patch Changes

• 9bec2c3: chore(provider/gateway): update gateway model settings files

4.0.119

Patch Changes

• 9d13c4d: Add the MiniMax M3.1 Flash model ID to the MiniMax and AI Gateway providers.
• 0c2a9de: Add maxOutputTokens and reasoning to experimental decision calls and forward them to language-model-backed decisions. Language-model adapters keep reasoning disabled when omitted. Native decision providers warn when either setting is unsupported.
• Updated dependencies [0c2a9de]
• Updated dependencies [200c47f]
  • @​ai-sdk/provider@​4.0.31
  • @​ai-sdk/provider-utils@​5.0.64

4.0.118

Patch Changes

• 1c47fee: chore(provider/gateway): update gateway model settings files

4.0.117

Patch Changes

• 6b7fb8f: chore(provider/gateway): update gateway model settings files
• Updated dependencies [60cc252]
  • @​ai-sdk/provider@​4.0.30
  • @​ai-sdk/provider-utils@​5.0.63

4.0.116

Patch Changes

• Updated dependencies [0957554]
  • @​ai-sdk/provider@​4.0.29
  • @​ai-sdk/provider-utils@​5.0.62

4.0.115

... (truncated)

Commits

• e6230e4 Version Packages (#23638)
• f1b550e perf(gateway): defer schema construction until first use (#23655)
• 5046699 fix(langchain): use secureJsonParse for tool call arguments (#16320)
• bb40cf0 Version Packages (#23596)
• 9bec2c3 chore(provider/gateway): update gateway model settings files (#23621)
• 0a5c786 Version Packages (#23572)
• 0c2a9de feat: add maxOutputTokens and reasoning to decide (#23590)
• be27bec Version Packages (#23565)
• eec6f49 fix(ci): package tsdown config (#23564)
• 92d9e2d Version Packages (#23472)
• Additional commits viewable in compare view

Updates @google-cloud/text-to-speech from 7.1.0 to 7.2.0

Release notes

Sourced from @​google-cloud/text-to-speech's releases.

text-to-speech: v7.2.0

7.2.0 (2026-10-08)

Features

• Update API sources and regenerate (#9554) (8b6837a)

video-intelligence: v7.2.0

7.2.0 (2026-10-08)

Features

• Update API sources and regenerate (#9554) (8b6837a)

Changelog

Sourced from @​google-cloud/text-to-speech's changelog.

7.2.0 (2026-10-08)

Features

• Update API sources and regenerate (#9554) (8b6837a)

7.1.1 (2026-09-28)

Bug Fixes

• Update package.json and .gitignore across packages (#9378) (9c54cec)

Commits

• 703154b chore: release main (#9584)
• 6375767 chore(packages): migrate generated packages to runtime-agnostic test runner (...
• 27c2f65 chore: release main (#9442)
• 9c54cec fix: update package.json and .gitignore across packages (#9378)
• cd8400f chore: upgrade to latest version of gapic-generator-typescript (#9374)
• 65a9440 chore: revert update .nycrc, Contributing.md, and .gitignore across packages ...
• 3ff5ae9 chore: update .nycrc, Contributing.md, and .gitignore across packages (#9144)
• e96b309 chore: release main (#9262)
• c249594 chore: upgrade librarian gapic-generator-typescript to v5.2.0 (#9252)
• See full diff in compare view

Updates @google/genai from 2.24.0 to 2.30.0

Release notes

Sourced from @​google/genai's releases.

v2.30.0

2.30.0 (2026-10-14)

Features

• interactions: add gemini-4-argon to Model enum (8a3c307)

Bug Fixes

• clear continuation state and preserve prompt feedback when continuation hop returns no candidates (e63d1f1)
• fix the grounding metadata merging for automatic continuation in generate content and generate content stream (6bfba87)
• make continuation streams retry dropped hops, stop on prompt_feedback, and keep real errors in generate_content (6bdc0d9)
• type GeminiNextGen signatures with public, importable names (ad3fb89)

v2.29.1

2.29.1 (2026-10-13)

Bug Fixes

• concatenate output_text across multi-step model responses in a turn (567cc8a)

v2.29.0

2.29.0 (2026-10-13)

Features

• accumulate streaming continuation usage metadata and expose initialPromptTokenCount (dbc961f)
• Add continuation_token to the Interactions interaction.status_update event. (a93776c)
• Add a CONTINUATION_REQUIRED Interaction status (754f71f)
• add billable token counts fields (839ffc2)
• Add startOffset/endOffset to Transcription and interimTranscriptTimestampEnabled to RealtimeInputConfig (bdbf156)
• Add usage in InteractionStatusUpdate events (8892aea)
• automatically consume the continuation token (98637d1)
• cli: update Speakeasy generator to v2.948.0, bump CLI to v0.4.2, and apply CLI overlay fixes (22d53ec)

Bug Fixes

• clear intermediate CONTINUATION finishReason in streaming continuation (22706af)
• do not record incomplete continuation stream turns in curated chat history (81c3c49)
• gemini-api-cli: remove unsupported 2.5 and 1.6 models from Interactions model options and CLI examples (1002720)
• js: do not set initial prompt token count for requests that do not use automatic consumption of continuation token (0885fb9)
• js: fix streaming continuation edge cases (stale token, AbortError, initialPromptTokenCount) (f3d10a6)
• Raise default HTTP timeouts so long-running requests aren't killed client-side (10e850c)
• resume streaming generation from the latest checkpoint continuation token on mid-stream errors or cutoffs (625ac2c)
• Update EnvironmentConfig.env schema to map keys to EnvVar or string. (8478e12)

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

2.30.0 (2026-10-14)

Features

• interactions: add gemini-4-argon to Model enum (8a3c307)

Bug Fixes

• clear continuation state and preserve prompt feedback when continuation hop returns no candidates (e63d1f1)
• fix the grounding metadata merging for automatic continuation in generate content and generate content stream (6bfba87)
• make continuation streams retry dropped hops, stop on prompt_feedback, and keep real errors in generate_content (6bdc0d9)
• type GeminiNextGen signatures with public, importable names (ad3fb89)

2.29.1 (2026-10-13)

Bug Fixes

• concatenate output_text across multi-step model responses in a turn (567cc8a)

2.29.0 (2026-10-13)

Features

• accumulate streaming continuation usage metadata and expose initialPromptTokenCount (dbc961f)
• Add continuation_token to the Interactions interaction.status_update event. (a93776c)
• Add a CONTINUATION_REQUIRED Interaction status (754f71f)
• add billable token counts fields (839ffc2)
• Add startOffset/endOffset to Transcription and interimTranscriptTimestampEnabled to RealtimeInputConfig (bdbf156)
• Add usage in InteractionStatusUpdate events (8892aea)
• automatically consume the continuation token (98637d1)
• cli: update Speakeasy generator to v2.948.0, bump CLI to v0.4.2, and apply CLI overlay fixes (22d53ec)

Bug Fixes

• clear intermediate CONTINUATION finishReason in streaming continuation (22706af)
• do not record incomplete continuation stream turns in curated chat history (81c3c49)
• gemini-api-cli: remove unsupported 2.5 and 1.6 models from Interactions model options and CLI examples (1002720)
• js: do not set initial prompt token count for requests that do not use automatic consumption of continuation token (0885fb9)
• js: fix streaming continuation edge cases (stale token, AbortError, initialPromptTokenCount) (f3d10a6)
• Raise default HTTP timeouts so long-running requests aren't killed client-side (10e850c)
• resume streaming generation from the latest checkpoint continuation token on mid-stream errors or cutoffs (625ac2c)
• Update EnvironmentConfig.env schema to map keys to EnvVar or string. (8478e12)

2.28.0 (2026-10-07)

... (truncated)

Commits

• 1de87f8 chore(main): release 2.30.0 (#2058)
• 14086e6 chore(cli): update Speakeasy OpenAPI generator to v2.948.9
• 433a33a chore: internal change
• 6bdc0d9 fix: make continuation streams retry dropped hops, stop on prompt_feedback, a...
• 6bfba87 fix: fix the grounding metadata merging for automatic continuation in generat...
• ad3fb89 fix: type GeminiNextGen signatures with public, importable names
• 8a3c307 feat(interactions): add gemini-4-argon to Model enum
• f2ad2c1 chore: Skip the code coverage workflow on push/PR (manual trigger only).
• e63d1f1 fix: clear continuation state and preserve prompt feedback when continuation ...
• 2e083a7 chore(main): release 2.29.1 (#2052)
• Additional commits viewable in compare view

Updates @types/node from 26.0.0 to 26.6.5

Commits

• See full diff in compare view

Updates ai from 7.0.112 to 7.0.148

Changelog

Sourced from ai's changelog.

7.0.148

Patch Changes

• Updated dependencies [b089ce8]
• Updated dependencies [39a776b]
• Updated dependencies [f1b550e]
  • @​ai-sdk/provider-utils@​5.0.65
  • @​ai-sdk/gateway@​4.0.121

7.0.147

Patch Changes

• 66e74dc: fix(ai): preserve repaired tool names in streamed UI message parts
• Updated dependencies [9bec2c3]
  • @​ai-sdk/gateway@​4.0.120

7.0.146

Patch Changes

• 0c2a9de: Add maxOutputTokens and reasoning to experimental decision calls and forward them to language-model-backed decisions. Language-model adapters keep reasoning disabled when omitted. Native decision providers warn when either setting is unsupported.
• 3785b2e: fix(ai): remove orphaned reasoning, including consecutive summary and reasoning-file parts, when pruning tool calls
• ab8eb61: Fix optional tools adding an incorrect undefined member to tool call, result, error, denied output, and execution event types.
• Updated dependencies [9d13c4d]
• Updated dependencies [0c2a9de]
• Updated dependencies [200c47f]
  • @​ai-sdk/gateway@​4.0.119
  • @​ai-sdk/provider@​4.0.31
  • @​ai-sdk/provider-utils@​5.0.64

7.0.145

Patch Changes

• Updated dependencies [1c47fee]
  • @​ai-sdk/gateway@​4.0.118

7.0.144

Patch Changes

• 60cc252: feat(perplexity): add decisions api support
• 0ed59e2: Fix streamText return types for reusable options and ReturnType by moving low-memory streaming to experimental_streamTextLowMemory. Replace experimental streamText({ experimental_lowMemory: true, ...options }) calls with experimental_streamTextLowMemory(options).
• Updated dependencies [60cc252]
• Updated dependencies [6b7fb8f]
  • @​ai-sdk/provider@​4.0.30
  • @​ai-sdk/gateway@​4.0.117
  • @​ai-sdk/provider-utils@​5.0.63

... (truncated)

Commits

• e6230e4 Version Packages (#23638)
• bb40cf0 Version Packages (#23596)
• b727074 docs(ai): fix JSDoc typo in choice output spec (#15575)
• 66e74dc fix: signed approvals fail after a streamed tool call is repaired to a differ...
• 0a5c786 Version Packages (#23572)
• 0c2a9de feat: add maxOutputTokens and reasoning to decide (#23590)
• ab8eb61 fix(ai): remove option tools from union types (#23473)
• 3785b2e fix: pruneMessages leaves orphaned reasoning after pruning associated tool ca...
• be27bec Version Packages (#23565)
• eec6f49 fix(ci): package tsdown config (#23564)
• Additional commits viewable in compare view

Updates chrome-devtools-mcp from 1.10.1 to 1.11.0

Release notes

Sourced from chrome-devtools-mcp's releases.

chrome-devtools-mcp: v1.11.0

1.11.0 (2026-10-15)

🎉 Features

• add --file-navigations flag to reject file: URL navigations (#2853) (54cae57)
• Add analyze_heapsnapshot_contexts MCP tool (#2791) (190aeee)
• add ignoreCache option to performance_start_trace (#2931) (3467d40)
• add maxNameLength truncation option to compare_heapsnapshots (#3098) (1e1c53e)
• Add pagination to compare_heapsnapshots (#3140) (daebfd1)
• config: add ConfigWatcher to watch config file changes (#3139) (9171f77)
• discover the config file in predefined locations (#2876) (02c0112)
• implement ffmpeg-free screencast tools enabled by default (#3123) (8953ea5)
• reduce StaticText noise in text snapshots (#2895) (4441325)
• report pages opened by input actions (#2679) (28fb230)
• resolve config defaults after merging CLI and config file (#2849) (bdeb70d)
• return failing audits and DOM nodes inline from lighthouse_audit (#2930) (241fba5)
• skip more redundant data in text snapshots (#2896) (b2f522c)
• support debugging WebMCP tools in third-party developer tools (#2900) (0db519f)
• support emulating additional CSS media features (#2929) (69524f0)
• support evaluating scripts from local files (#2606) (9cf47a4)
• Support truncation in get_heapsnapshot_details (#3137) (f827e06)
• Truncate long names by default to 100 characters (#2893) (5ddb0a3)

🛠️ Fixes

• account for scroll offsets in downscaled screenshots (#2685) (830c693)
• allow --categoryExtensions when connecting to an existing browser (#3041) (d250bc5)
• allow stopping the CLI if command fails (#3088) (77e238e), closes #2982
• avoid runtime title fetches (#2883) (04195d1)
• better config support for chrome-devtools CLI (#2819) (9624e64)
• clamp async stack trace separator repeat count (#3035) (93e06ab), closes #3031
• cli: pass positional values starting with - through to tools (#3084) (9de05ae), closes #2984
• collectors: ignore transient target errors when subscribing to service workers (#2888) (551dd6c)
• daemon: bound browser shutdown and avoid watchFile timeout on stop (#2887) (f3db5e7)
• daemon: keep fallback socket in private runtime dir (#2766) (871a37e)
• daemon: verify process identity before treating PID file as active (#3109) (b608bed)
• do not close a healthy browser when a tool call outlasts 60s (#3149) (39c7db1)
• ensure aggregate IDs in heap snapshots are deterministic (#2923) (e918c47)
• escape client-supplied values in McpContext logs and errors (#2832) (efb0d02), closes #2831
• fail fast on tool calls stuck after a dead browser connection (#2699) (2a7ef50)
• harden third-party tool result serialization (#2892) (4418a7b)
• honor explicit --allowUnrestrictedPaths=false in CLI mode (#3040) (61fc362)
• include errors in slim responses (#3085) (ee38097)
• input: reject multiple file paths on single-file input in upload_file (#2995) (#3135) (e650843)
• list fresh page titles (#3103) (e717082)
• memory: reject contradictory pagination options in take_heapsnapshot (#3002) (#3131) (508126c)
• network: enforce URL policy across redirects (#2767) (274cd4c)

... (truncated)

Changelog

Sourced from chrome-devtools-mcp's changelog.

1.11.0 (2026-10-15)

🎉 Features

• add --file-navigations flag to reject file: URL navigations (#2853) (54cae57)
• Add analyze_heapsnapshot_contexts MCP tool (#2791) (190aeee)
• add ignoreCache option to performance_start_trace (#2931) (3467d40)
• add maxNameLength truncation option to compare_heapsnapshots (#3098) (1e1c53e)
• Add pagination to compare_heapsnapshots (#3140) (daebfd1)
• config: add ConfigWatcher to watch config file changes (#3139) (9171f77)
• discover the config file in predefined locations (#2876) (02c0112)
• implement ffmpeg-free screencast tools enabled by default (#3123) (8953ea5)
• reduce StaticText noise in text snapshots (#2895) (4441325)
• report pages opened by input actions (#2679) (28fb230)
• resolve config defaults after merging CLI and config file (#2849) (bdeb70d)
• return failing audits and DOM nodes inline from lighthouse_audit (#2930) (241fba5)
• skip more redundant data in text snapshots (#2896) (b2f522c)
• support debugging WebMCP tools in third-party developer tools (#2900) (0db519f)
• support emulating additional CSS media features (#2929) (69524f0)
• support evaluating scripts from local files (#2606) (9cf47a4)
• Support truncation in get_heapsnapshot_details (#3137) (f827e06)
• Truncate long names by default to 100 characters (#2893) (5ddb0a3)

🛠️ Fixes

• account for scroll offsets in downscaled screenshots (#2685) (830c693)
• allow --categoryExtensions when connecting to an existing browser (#3041) (d250bc5)
• allow stopping the CLI if command fails (#3088) (77e238e), closes #2982
• avoid runtime title fetches (#2883) (04195d1)
• better config support for chrome-devtools CLI (#2819) (9624e64)
• clamp async stack trace separator repeat count (#3035) (93e06ab), closes #3031
• cli: pass positional values starting with - through to tools (#3084) (9de05ae), closes #2984
• collectors: ignore transient target errors when subscribing to service workers (#2888) (551dd6c)
• daemon: bound browser shutdown and avoid watchFile timeout on stop (#2887) (f3db5e7)
• daemon: keep fallback socket in private runtime dir (#2766) (871a37e)
• daemon: verify process identity before treating PID file as active (#3109) (b608bed)
• do not close a healthy browser when a tool call outlasts 60s (#3149) (39c7db1)
• ensure aggregate IDs in heap snapshots are deterministic (#2923) (e918c47)
• escape client-supplied values in McpContext logs and errors (#2832) (efb0d02), closes #2831
• fail fast on tool calls stuck after a dead browser connection (#2699) (2a7ef50)
• harden third-party tool result serialization (#2892) (4418a7b)
• honor explicit --allowUnrestrictedPaths=false in CLI mode (#3040) (61fc362)
• include errors in slim responses (#3085) (ee38097)
• input: reject multiple file paths on single-file input in upload_file (#2995) (#3135) (e650843)
• list fresh page titles (#3103) (e717082)
• memory: reject contradictory pagination options in take_heapsnapshot (#3002) (#3131) (508126c)
• network: enforce URL policy across redirects (#2767) (274cd4c)
• pass categoryExtensions to the target filter when connecting (#3047) (4e90238)

... (truncated)

Commits

• a878bca chore(main): release chrome-devtools-mcp 1.11.0 (#2823)
• 2650285 test: share one daemon in hyphen positionals e2e test (#3157)
• c87d190 fix: url pattern partial ipv4 (#2859)
• 62e2aa4 fix: record screencast at the page's device pixel size (#3155)
• b608bed fix(daemon): verify process identity before treating PID file as active (#3109)
• ce5d35c test: cover blocklist/allowlist enforcement for service worker requests (#3138)
• ee38097 fix: include errors in slim responses (#3085)
• 05545a0 chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 u...
• 3cee3bd fix: propagate failed responseFilePath write error instead of reporting body ...
• 235ea2c test(config): wait for fs.watch readiness in ConfigWatcher tests (#3153)
• Additional commits viewable in compare view

Updates dotenv from 18.0.3 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

• Fast parser should strip appended extra quotes (#1073)
• Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#1070)
• CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

• Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

• Fix missing typescript module declaration (#1068)
• Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

• import dotenv/config should default quiet: true (#1063)

Commits

• e2fe95e 18.0.8
• 7aa712a type detail improvement
• 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
• 0b4843a changelog
• 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
• f757811 fix(types): allow undefined values in populate output
• fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
• 2953207 18.0.7
• 9944723 make more readable for undefined -> null
• d455db0 Merge branch 'master' of github.com:motdotla/dotenv
• Additional commits viewable in compare view

Updates openai from 7.23....

Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Oct 24, 2026 9:01pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: groupthinking/EventRelay
• Branch: main
• File: .coderabbit.yaml
• Commit: e93fd0e
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f749775d-3f68-4899-a9e6-90014b983b92

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 PR Validation

⚠️ Large PR detected (8087 lines changed)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

[groupthinking]

Review at head 91083398: this 37-package update is not ready. Python 3.11/3.12 tests fail in test_node_engines_floor.py because the lockfile's jsdom entry lacks expected engine and Undici metadata. Coverage and E2E checks also fail; the E2E job could not resolve a Vercel preview for this SHA. Please repair the lockfile/test failures, verify a preview for the exact head, and rerun the affected checks before another review.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.